From: Al Viro <viro@zeniv.linux.org.uk>
To: Christian Brauner <brauner@kernel.org>
Cc: linux-fsdevel@vger.kernel.org,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: reproducer for "do_move_mount(): don't leak MNTNS_PROPAGATING on failures"
Date: Thu, 8 May 2025 21:03:32 +0100 [thread overview]
Message-ID: <20250508200332.GH2023217@ZenIV> (raw)
In-Reply-To: <20250508200211.GF2023217@ZenIV>
#include <string.h>
#include <unistd.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <stdio.h>
static int tmpfs(const char *name)
{
return mount("none", name, "tmpfs", 0, NULL);
}
static int change(const char *name, int how)
{
return mount(NULL, name, NULL, how, NULL);
}
static int bind(const char *from, const char *to)
{
return mount(from, to, NULL, MS_BIND, NULL);
}
static _Bool exists(const char *name)
{
return access(name, F_OK) != -1;
}
void playground(void)
{
mkdir("/tmp/foo", 0700);
tmpfs("/tmp/foo");
change("/tmp/foo", MS_PRIVATE);
chdir("/tmp/foo");
}
void cleanup(int fd)
{
close(fd);
chdir("/tmp");
umount2("/tmp/foo", MNT_DETACH);
rmdir("/tmp/foo");
}
main()
{
playground();
mkdir("A", 0700);
mkdir("A/subdir", 0700);
mkdir("B", 0700);
bind("A", "A");
change("A", MS_SHARED);
int fd = open_tree(AT_FDCWD, "A", OPEN_TREE_CLONE);
// this move_mount should fail (directory on top of non-directory)
if (move_mount(fd, "", AT_FDCWD, "/dev/null", MOVE_MOUNT_F_EMPTY_PATH) == 0) {
printf("unexpected success of first move_mount()\n");
cleanup(fd);
return -1;
}
// this should propagate into detached tree
tmpfs("A/subdir");
mkdir("A/subdir/foo", 0700);
// move detached tree in, so we could check it
if (move_mount(fd, "", AT_FDCWD, "B", MOVE_MOUNT_F_EMPTY_PATH) != 0) {
printf("unexpected failure of the second move_mount()\n");
cleanup(fd);
}
if (!exists("B/subdir/foo")) {
printf("failed to propagate into detached tree\n");
cleanup(fd);
return -1;
}
printf("success\n");
cleanup(fd);
return 0;
}
next prev parent reply other threads:[~2025-05-08 20:03 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-04-28 6:30 [RFC] move_mount(2): still breakage around new mount detection Al Viro
2025-04-28 7:03 ` Al Viro
2025-04-28 8:50 ` Christian Brauner
2025-04-28 18:53 ` Al Viro
2025-04-29 4:03 ` Al Viro
2025-04-29 5:10 ` Al Viro
2025-04-29 5:27 ` Al Viro
2025-04-29 8:21 ` Christian Brauner
2025-05-05 5:08 ` Al Viro
2025-05-05 14:20 ` Christian Brauner
2025-04-29 7:56 ` Christian Brauner
2025-04-29 12:27 ` Al Viro
2025-04-29 7:52 ` Christian Brauner
2025-05-08 5:56 ` more breakage there (was Re: [RFC] move_mount(2): still breakage around new mount detection) Al Viro
2025-05-08 19:59 ` Al Viro
2025-05-08 20:00 ` [PATCH 1/4] __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock Al Viro
2025-05-09 11:02 ` Christian Brauner
2025-05-08 20:01 ` [PATCH 2/4] do_umount(): add missing barrier before refcount checks in sync case Al Viro
2025-05-09 11:02 ` Christian Brauner
2025-05-08 20:02 ` [PATCH 3/4] do_move_mount(): don't leak MNTNS_PROPAGATING on failures Al Viro
2025-05-08 20:03 ` Al Viro [this message]
2025-05-09 11:02 ` Christian Brauner
2025-05-13 11:03 ` Lai, Yi
2025-05-13 12:08 ` Al Viro
2025-05-13 14:33 ` Lai, Yi
2025-05-08 20:02 ` [PATCH 4/4] fix IS_MNT_PROPAGATING uses Al Viro
2025-05-08 20:04 ` reproducer for "fix IS_MNT_PROPAGATING uses" Al Viro
2025-05-09 11:01 ` [PATCH 4/4] fix IS_MNT_PROPAGATING uses Christian Brauner
2025-05-09 11:06 ` more breakage there (was Re: [RFC] move_mount(2): still breakage around new mount detection) Christian Brauner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250508200332.GH2023217@ZenIV \
--to=viro@zeniv.linux.org.uk \
--cc=brauner@kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.